1
0
mirror of https://github.com/django/django.git synced 2025-11-07 07:15:35 +00:00
Commit Graph

8 Commits

Author SHA1 Message Date
Jacob Walls
98e642c691 Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the _connector kwarg.
Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon
Charette, and Jake Howard for the reviews.
2025-11-05 09:20:57 -03:00
Jacob Walls
c880530ddd Fixed CVE-2025-64458 -- Mitigated potential DoS in HttpResponseRedirect/HttpResponsePermanentRedirect on Windows.
Thanks Seokchan Yoon for the report, Markus Holtermann for the
triage, and Jake Howard for the review.

Follow-up to CVE-2025-27556 and 39e2297210.
2025-11-05 09:20:57 -03:00
Hal Blackburn
74564946c3 Fixed #36704 -- Fixed system check error for proxy model with a composite pk.
Proxy models subclassing a model with a CompositePrimaryKey were
incorrectly reporting check errors because the check that requires only
local fields to be used in a composite pk was evaluated against the proxy
subclass, which has no fields.

To fix this, composite pk field checks are not evaluated against
proxy subclasses, as none of the checks are applicable to proxy
subclasses. This also has the benefit of not double-reporting real check
errors from an invalid superclass pk.

Thanks Clifford Gama for the review.
2025-11-04 11:59:21 -05:00
Jacob Walls
ab108bf94d Added stub release notes and release date for 5.2.8, 5.1.14, and 4.2.26. 2025-10-29 14:57:45 -03:00
Mariusz Felisiak
56977b466c Refs #35844 -- Doc'd Python 3.14 compatibility. 2025-10-17 19:25:02 +02:00
Jacob Walls
02eed4f378 Fixed #36648, Refs #33772 -- Accounted for composite pks in first()/last() when aggregating. 2025-10-14 15:48:29 -04:00
Simon Charette
315dbe675d Fixed #36646 -- Added compatibility for oracledb 3.4.0.
The Database.Binary, Date, and Timestamp attributes were changed from
aliases to bytes, datetime.date, and datetime.datetime to factory
functions in oracle/python-oracledb@869a887819
which made their usage inadequate for isinstance checks.

Thanks John Wagenleitner for the report and Natalia for the triage.

Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2025-10-11 17:15:28 +02:00
Jacob Walls
1324d9037e Added stub release notes for 5.2.8. 2025-10-01 10:30:45 -04:00